Installing the Dansguardian package in PFSense - One user's experience

On a related note… It did not work when I tried booting without the script to restart dansguardian at the end of the bootup. Without the script it appears that dansguardian starts up, squid starts after and then dansg eventually shuts down.

This one might be a little off topic, but let me throw out another "feature" idea from something that I originally had working on my IPCop box. I had IPCop running with DG/Squid by using the copplus addon. In addition, found a script that got me started and then made some changes to implement a "Dansguardian Bypass" that would allow you to enter a password and bypass filtering for a time period. It's nice because sometimes DG is overly aggressive in filtering. I don't remember where I got the setup script, but on IPCop it was doing perl CGI to a web server on port 81. It also looks like someone did the same thing with PHP on ClearOS (see http://honestpchelp.com/2011/clearos-dansguardian-accessdenied-php-bypass-script/).

It's a dansguardian feature, but I did not included on gui. check dansguardian.conf to see the secret.

I'm going to play around trying to get it to work on PFSense. However, the forum instructions I found for setting up a web server required installing a couple packages and mysql (see http://forum.pfsense.org/index.php/topic,47086.msg247364.html#msg247364)… it just seemed a little excessive to me since there's already a web server running for the web interface. Is there an easy way to get a web server instance that supports perl CGI or PHP on another port? Or... better yet, has anyone already implemented the bypass feature?

I'll test it this week.

It appears that there is no way to get the GUI to not overwrite my changes when the config is saved (for the access denied php page that I put in place)… Would it be possible to add an option to the GUI so that you can specify a URL for the access denied page rather than having the user supply the HTML page content?

Yes, it is there but RJCrowder is suggesting specifying a URL instead (or that's how I read it)

Would it be possible to add an option to the GUI so that you can specify a URL for the access denied page rather than having the user supply the HTML page content?

I'm merely asking to have both which could be achieved quite easily by allowing the reporting level and a redirect URL to be exposed through the GUI. Dansguardian will use the local HTML when the reporting level is 3 and the redirect URL when it is at levels 1 or 2.

Think I may have tracked down why Dans doesn't start properly on bootup (on my setup)
I get this error:
php: : The command '/usr/local/sbin/squid -k reconfigure' returned exit code '1', the output was '2012/04/25 10:17:58| WARNING: '192.168.0.0/255.255.255.0' is a subnetwork of '192.168.0.0/255.255.255.0' 2012/04/25 10:17:58| WARNING: because of this '192.168.0.0/255.255.255.0' is ignored to keep splay tree searching predictable 2012/04/25 10:17:58| WARNING: You should probably remove '192.168.0.0/255.255.255.0' from the ACL named 'localnet' squid: ERROR: No running copy'

On my squid setup I have chosen to select LAN + loopback, so that the children go through the 8080 dans proxy and my machine uses 3128 (for caching purposes)
Is it possible that this is causing the error and not allowing dans to start automatically.

Still starts when I go in and press start.
Or am I just completely barking up the wrong tree…. ::)
Thanks
Chris

Just another quick note on something that needs to be done… it appears that DG log rotation is not setup. You can enable the "logrotation" script in /usr/local/share/dansguardian/scripts/. To get it working, do the following.

1. Edit /usr/local/share/dansguardian/scripts/logrotation and change
LOG_DIR=/var/log/ to
LOG_DIR=/var/log/dansguardian
2. Make the file executable
chmod +x /usr/local/share/dansguardian/scripts/logrotation
3. Add it to your list of scheduled tasks in cron so that it executes once a week. To do so, I installed the "cron" package and added an entry as follows (executes at 2:30am on Saturday):
30 2 sat root /usr/local/share/dansguardian/scripts/logrotation

Firstly - Thanks Marcello that's excellent news. Can I just clarify that where you say "apply config and reboot" do you mean manually apply the config or restore from a saved xml config ? Would that work ? (Just saves me some time if it does).

Secondly and totally unconnected here's a strange one for Netflix users.

I recently re-installed my windows system onto a new SSD and subsequently my Netflix gave a Silverlight N8152 DRM error when starting. I tried every suggested fix I could find for what is apparently a fairly common error all to no avail. The solution I found that worked for me was to disable the Dansguardian redirect rule, start Netflix, watch a moment of some content then stop Netflix and re-enable the redirect rule for DG, no more DRM N8152 Silverlight problem…..

Firstly - Thanks Marcello that's excellent news. Can I just clarify that where you say "apply config and reboot" do you mean manually apply the config or restore from a saved xml config ? Would that work ? (Just saves me some time if it does).

Reinstall the package, go on dansguardian gui, manually apply the config. If you whant to test boot process, reboot after apply config.

The Problem:
If I set on the configuration page of Dansguardian (>Services>Dansguardian>Daemon) the Proxi-IP to 127.0.0.1 and leave the value for the Proxy-Port empty (for the default) in the config file of Dansguardian (/usr/local/etc/dansguardian/dansguardian.conf) the value 127.0.0.1 will be written for the proxy-port entry (proxyport = 127.0.0.1).

My Solution:
Manually set the value of the proxyport setting in /usr/local/etc/dansguardian/dansguardian.conf
(In the pfSense-webgui for example by browsing to the config-file via >Diagnostics>Edit File).

The Problem:
If I set on the configuration page of Dansguardian (>Services>Dansguardian>Daemon) the Proxi-IP to 127.0.0.1 and leave the value for the Proxy-Port empty (for the default) in the config file of Dansguardian (/usr/local/etc/dansguardian/dansguardian.conf) the value 127.0.0.1 will be written for the proxy-port entry (proxyport = 127.0.0.1).

My Solution:
Manually set the value of the proxyport setting in /usr/local/etc/dansguardian/dansguardian.conf

Hi and thanks to all you where of great help..
I installed DansGuardian and Squid from packages, works fine, just a few questions,

is there a need to put in a blacklist url into Dansguardian?

I'm trying to get "phrase" to work and it doesn't seem to?
I tried to just put e.g. "<gambling>" with or without spaces front or back but with out any response? Was able to enter any gambling site there is?
And while we are at it, where are the category settings? Also when a block comes up it just says Category regular expressions? wondering.
TIA

P.S. as a newbie using pfsense, thanks to the Makers, its unreal, great work.
and thanks to the maker of the DG pkg very nice job.</gambling>

I tried to just put e.g. "<gambling>" with or without spaces front or back but with out any response? Was able to enter any gambling site there is?</gambling>

You have to check to get dansguardian working before going on access lists.

Check if it's listening,
Check if dansguardian is sending traffic to squid
Check if clients are using dansguardian ip/port as their proxies.
check log files to see what is passing through dansguardian.
etc, etc, etc.

This package gui follow dansguardian conf files, so you need some dansguardian knowledge to get it working

guys, i'm at a loss here… I installed the dansguardian package and then had to uninstall it, and now after a reinstall, I can't get the gui components of the package to ever finish installing... it just stops at this part:

Can someone please tell me what I should do here? I have DG working on another server but wanted to do it all on the pfsense box if i could…that way I can filter sites for my kids IPODs and stuff that doesn't have proxy settings easily available.

I didn't really see any errors on the logs or console…. i think it's probably about a year old installation at best. I have upgraded it whenever the upgrade was available from the main repository. I think dg is actually installing, but i'm not seeing any portions of it available for configuration in the GUI.

ok, well, i guess i have no other choice but to fully wipe the pfsense install and start over… luckily, i don't have a very involved configuration so it shouldn't take too long, just have to deal with a wife who will not be happy for me blocking her facebook time. lol

Nice write up.. i have installed Dansguardian and configured it as you said. but after finishing 1st step, when i test it I cannot browse anything at all, no good site, no bad site, no pfsense either. any idea what i am doing wrong.

OK.. managed to setup DG successfully. Now, how do i check the reports based on AD username??

Marcello thx for the DG packages, using this topic i have it running almost perfekt.

The problems that i have are that sarg its showing only the logs for 2 days (13 and 21 August) and only with the ip adress from my pfsense install.
In "realtime" i have the hosts names visible. With lightsquid i have couple days more, but same only with pfsense ip adress. Squid is running transparent.

The second problem is: i have 2 samsung TVs and i stream internet radio with this (vtuner App). I placed the 2 TV IPs in Exception and now one its working, the second cannot connect to the stream servers. In the log file its showing "miss" and not "denied".

The problems that i have are that sarg its showing only the logs for 2 days (13 and 21 August) and only with the ip adress from my pfsense install.
In "realtime" i have the hosts names visible. With lightsquid i have couple days more, but same only with pfsense ip adress. Squid is running transparent.

The second problem is: i have 2 samsung TVs and i stream internet radio with this (vtuner App). I placed the 2 TV IPs in Exception and now one its working, the second cannot connect to the stream servers. In the log file its showing "miss" and not "denied".

and I have created a separate computer/box/server that handles Dansguardian+Squid. On my pfsense firewall, I have installed the squid package (2.7.9 pkg v.4.3.2) then I enable transparent proxy option on that one, and added this line on the custom configuration part:

cache_peer 192.168.127.222 parent 3128 0 no-query no-digest

then I added the squid/dansguardian ip to the bypass proxy originating from this ip line. I have also used "null" for the hardisk cache system so that i won't be caching the same thing twice. Everything is working with this setup so far, the only problem I am having is that on the dansguardian/squid box, that is logged is the ip of the pfsense box and not the ips of the computers used by our users. I do understand why this is so, but I can't seem to figure out how to have the original ips passed to the squid/dansguardian box… any ideas? Thanks!

The only purpose why I need to have the original IP on the dansguardian/squid box is so I can do filter groups based on the ip addresses of user's computers.

With regards to your suggestion on making my dansguardian/squid box as the gateway then route web traffic through there, can you explain a bit further? (ive attached a sample rule for it.. at least that's how interpret it.

I'm thinking that this might be a better solution than what I currently have in mind to do. So on the pfsense box, I can install the dansguardian package and then do all the ACL and filter groups on the firewall itself then just make an external squid box that will serve as parent for the dansguardian package in the firewall. If this is possible, I wanted to ask what do you mean "transparent with nat rules"… Can you kindly give me an example? Thanks!